From 5633ec92a1545fef157a5e5d5b4d5683baa4f68f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bu=C4=9Fra?= <bcanata@hotmail.com>
Date: Thu, 10 Jul 2025 13:02:52 +0300
Subject: [PATCH] feat: add role-based access control for admin panel
 authentication

---
 public/decapcms/config.yml |  2 ++
 public/decapcms/index.html | 25 ++++++++++++++++++++++++-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/public/decapcms/config.yml b/public/decapcms/config.yml
index cf05ac0..94c47b8 100644
--- a/public/decapcms/config.yml
+++ b/public/decapcms/config.yml
@@ -5,6 +5,8 @@ backend:
   accept_roles:          #  ← the magic line
     - admin
     - editor
+  # Explicitly block users without roles
+  squash_merges: true
 
 media_folder: 'src/assets/images'
 public_folder: '/_astro'
diff --git a/public/decapcms/index.html b/public/decapcms/index.html
index 1b1b418..b1bdc88 100644
--- a/public/decapcms/index.html
+++ b/public/decapcms/index.html
@@ -11,15 +11,38 @@
     <!-- Include the script that builds the page and powers Decap CMS -->
     <script src="https://unpkg.com/decap-cms@^3.0.0/dist/decap-cms.js"></script>
     <script>
-      // Initialize Netlify Identity widget
+      // Initialize Netlify Identity widget with role checking
       if (window.netlifyIdentity) {
         window.netlifyIdentity.on('init', (user) => {
           if (!user) {
             window.netlifyIdentity.on('login', () => {
               document.location.href = '/admin/';
             });
+          } else {
+            // Check if user has required roles
+            checkUserRole(user);
           }
         });
+        
+        window.netlifyIdentity.on('login', (user) => {
+          checkUserRole(user);
+        });
+      }
+      
+      function checkUserRole(user) {
+        const allowedRoles = ['admin', 'editor'];
+        const userRoles = user.app_metadata?.roles || [];
+        
+        // Check if user has any of the allowed roles
+        const hasAccess = allowedRoles.some(role => userRoles.includes(role));
+        
+        if (!hasAccess) {
+          // User doesn't have required roles
+          alert('Erişim reddedildi. Bu alanı kullanmak için yönetici izni gereklidir.');
+          window.netlifyIdentity.logout();
+          window.location.href = '/';
+          return;
+        }
       }
     </script>
   </body>